feat(swift): ship native iOS app to TestFlight - #2629
Merged
Conversation
Contributor
WalkthroughAdds native iOS/watchOS bundle identifiers and platform settings, plus a Bun script that archives, exports, and uploads the iOS app to TestFlight. Swift build and signing artifacts are ignored, and launch-time formatting is adjusted. ChangesNative TestFlight packaging
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Coverage Report for packages/utils (./packages/utils)
File CoverageNo changed files found. |
Contributor
Coverage Report for packages/units (./packages/units)
File CoverageNo changed files found. |
Contributor
Coverage Report for packages/analytics (./packages/analytics)
File CoverageNo changed files found. |
Contributor
Coverage Report for apps/expo (./apps/expo)
File CoverageNo changed files found. |
Contributor
Coverage Report for packages/overpass (./packages/overpass)
File CoverageNo changed files found. |
Contributor
Coverage Report for packages/mcp (./packages/mcp)
File CoverageNo changed files found. |
Contributor
Coverage Report for packages/api (./packages/api)
File CoverageNo changed files found. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- Fix invalid redeclaration of init() in PackRatApp.swift (bad merge left two init() bodies; merged Sentry-start into the macOS reset-auth init). iOS build was failing to compile before this. - Move native Swift app to its own bundle id com.andrewbierman.packrat.swift (iOS + watch companion ref + watch app) so it gets an isolated App Store Connect record and TestFlight tester pool, separate from the production Expo app. macOS record and Google-OAuth URL scheme unchanged. - Add apps/swift/scripts/upload-testflight.ts: archive for device, export a signed .ipa, upload via xcrun altool using an Apple ID app-specific password (no App Store Connect API key required). - Gitignore apps/swift/build/ and build.log. Claude-Session: https://claude.ai/code/session_018Aqkh7awkxfC5q4KKwjdM3
mikib0
force-pushed
the
feat/swift-testflight-upload
branch
from
July 16, 2026 15:13
d657ca1 to
34dd12a
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/swift/scripts/upload-testflight.ts`:
- Around line 52-55: Refactor run to accept one tuple containing the command and
arguments, while preserving execFileSync behavior. Redact the Apple app-specific
password from the command string before console.log output, and update all three
run call sites to pass their command and arguments as a single array.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: b26b8f56-5f70-425b-b05d-aa2cf846e989
📒 Files selected for processing (5)
.gitignoreapps/swift/Resources/Info-watchOS.plistapps/swift/Sources/PackRat/PackRatApp.swiftapps/swift/project.ymlapps/swift/scripts/upload-testflight.ts
Comment on lines
+52
to
+55
| function run(cmd: string, args: string[]) { | ||
| console.log(`\n$ ${cmd} ${args.join(' ')}`); | ||
| execFileSync(cmd, args, { stdio: 'inherit' }); | ||
| } |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
Fix pipeline failure and prevent credential leak.
The custom linter failed because the run function has two parameters. Additionally, logging args.join(' ') leaks the Apple app-specific password in plain text during the TestFlight upload step.
Refactor run to take a single tuple parameter and redact the password in the logs. You will also need to update the three call sites to pass a single array.
🔒️ Proposed fixes for the function and call sites
1. Update the function definition:
-function run(cmd: string, args: string[]) {
- console.log(`\n$ ${cmd} ${args.join(' ')}`);
- execFileSync(cmd, args, { stdio: 'inherit' });
+function run([cmd, ...args]: [string, ...string[]]) {
+ const safeArgs = args.map((arg, i) => args[i - 1] === '--password' ? '***' : arg);
+ console.log(`\n$ ${cmd} ${safeArgs.join(' ')}`);
+ execFileSync(cmd, args, { stdio: 'inherit' });
}2. Update the three call sites:
// 1. Archive for a real device (TestFlight cannot accept a simulator build).
-run('xcodebuild', [
+run([
+ 'xcodebuild',
'archive', // 2. Export a signed .ipa for App Store distribution.
const exportOptions = join(work, 'ExportOptions.plist');
...
-run('xcodebuild', [
+run([
+ 'xcodebuild',
'-exportArchive', // 3. Upload to TestFlight via altool (app-specific-password auth).
const ipa = join(exportDir, 'PackRat-iOS.ipa');
-run('xcrun', [
+run([
+ 'xcrun',
'altool',📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| function run(cmd: string, args: string[]) { | |
| console.log(`\n$ ${cmd} ${args.join(' ')}`); | |
| execFileSync(cmd, args, { stdio: 'inherit' }); | |
| } | |
| function run([cmd, ...args]: [string, ...string[]]) { | |
| const safeArgs = args.map((arg, i) => args[i - 1] === '--password' ? '***' : arg); | |
| console.log(`\n$ ${cmd} ${safeArgs.join(' ')}`); | |
| execFileSync(cmd, args, { stdio: 'inherit' }); | |
| } |
🧰 Tools
🪛 GitHub Actions: Checks / 0_checks.txt
[error] 52-52: Owned functions with too many params found (1). run has 2 params
🪛 GitHub Actions: Checks / checks
[error] 52-52: lint:custom failed: Owned functions with too many params found (1). Function 'run' has 2 params.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/swift/scripts/upload-testflight.ts` around lines 52 - 55, Refactor run
to accept one tuple containing the command and arguments, while preserving
execFileSync behavior. Redact the Apple app-specific password from the command
string before console.log output, and update all three run call sites to pass
their command and arguments as a single array.
Source: Pipeline failures
Chain of distribution-readiness fixes found while shipping the native Swift iOS app to TestFlight (the app had only ever been built for the simulator / tests, never archived for the App Store): - Compile the asset catalog: Assets.xcassets was under a `resources:` key that xcodegen silently ignores, so no Assets.car / app icons / CFBundleIconName were emitted (App Store errors 90713/90022/90023). Move it into `sources:` where xcodegen compiles it, and set ASSETCATALOG_COMPILER_APPICON_NAME. (macOS target has the same latent `resources:` bug — out of scope here.) - Add UISupportedInterfaceOrientations (all four) — required for iPad device family "1,2" (error 90474). - Do not embed PackRat-Watch in distribution builds: the watch app has no app icons (error 90391). Target stays in the repo; re-embed once watch icons exist. - Correct DEVELOPMENT_TEAM to 666HGMV2LU (Bierman Collective LLC), which owns the distribution cert and the app record. - upload-testflight.ts: pass -allowProvisioningUpdates to both archive and export (new bundle id has no pre-existing profiles), and use altool --username/--password + --asc-provider (the Apple ID belongs to multiple teams, so delivery must be disambiguated). - Gitignore signing material (*.p12/*.cer/*.certSigningRequest) and upload.log. Claude-Session: https://claude.ai/code/session_018Aqkh7awkxfC5q4KKwjdM3
mikib0
changed the title
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
apps/swift/scripts/upload-testflight.ts (1)
52-55: 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick winFix pipeline failure and prevent credential leak.
The custom linter failed because the
runfunction has two parameters. Additionally, loggingargs.join(' ')leaks the Apple app-specific password in plain text during the TestFlight upload step.Refactor
runto take a single tuple parameter and redact the password in the logs. You will also need to update the three call sites to pass a single array.🔒️ Proposed fixes for the function and call sites
1. Update the function definition:
-function run(cmd: string, args: string[]) { - console.log(`\n$ ${cmd} ${args.join(' ')}`); - execFileSync(cmd, args, { stdio: 'inherit' }); +function run([cmd, ...args]: [string, ...string[]]) { + const safeArgs = args.map((arg, i) => args[i - 1] === '--password' ? '***' : arg); + console.log(`\n$ ${cmd} ${safeArgs.join(' ')}`); + execFileSync(cmd, args, { stdio: 'inherit' }); }2. Update the three call sites:
// 1. Archive for a real device (TestFlight cannot accept a simulator build). -run('xcodebuild', [ +run([ + 'xcodebuild', 'archive',// 2. Export a signed .ipa for App Store distribution. const exportOptions = join(work, 'ExportOptions.plist'); ... -run('xcodebuild', [ +run([ + 'xcodebuild', '-exportArchive',// 3. Upload to TestFlight via altool (app-specific-password auth). const ipa = join(exportDir, 'PackRat-iOS.ipa'); -run('xcrun', [ +run([ + 'xcrun', 'altool',🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/swift/scripts/upload-testflight.ts` around lines 52 - 55, Update run to accept one tuple containing the command and arguments, then adjust all three call sites to pass that tuple as a single array. Preserve command execution while masking the Apple app-specific password in the logged command output, ensuring the credential never appears in plain text.Source: Pipeline failures
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/swift/scripts/upload-testflight.ts`:
- Line 29: Update the SWIFT_DIR definition to use Bun’s import.meta.dir instead
of constructing a URL pathname, ensuring paths containing spaces remain
correctly decoded for downstream xcodebuild operations.
---
Duplicate comments:
In `@apps/swift/scripts/upload-testflight.ts`:
- Around line 52-55: Update run to accept one tuple containing the command and
arguments, then adjust all three call sites to pass that tuple as a single
array. Preserve command execution while masking the Apple app-specific password
in the logged command output, ensuring the credential never appears in plain
text.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9f751f44-4960-47ae-a0a0-a1f468d7a34d
📒 Files selected for processing (6)
.gitignoreapps/swift/Resources/Info-iOS.plistapps/swift/Resources/Info-watchOS.plistapps/swift/Sources/PackRat/PackRatApp.swiftapps/swift/project.ymlapps/swift/scripts/upload-testflight.ts
| import { tmpdir } from 'node:os'; | ||
| import { join } from 'node:path'; | ||
|
|
||
| const SWIFT_DIR = new URL('..', import.meta.url).pathname; |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Use import.meta.dir to prevent path resolution failures.
new URL(...).pathname returns a URL-encoded string. If the repository's path contains spaces, .pathname will contain %20 instead of literal spaces, causing downstream xcodebuild steps to fail because the .xcodeproj file cannot be found. Since this is a Bun script, you can use the built-in import.meta.dir.
🛠 Proposed fix
-const SWIFT_DIR = new URL('..', import.meta.url).pathname;
+const SWIFT_DIR = join(import.meta.dir, '..');📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const SWIFT_DIR = new URL('..', import.meta.url).pathname; | |
| const SWIFT_DIR = join(import.meta.dir, '..'); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/swift/scripts/upload-testflight.ts` at line 29, Update the SWIFT_DIR
definition to use Bun’s import.meta.dir instead of constructing a URL pathname,
ensuring paths containing spaces remain correctly decoded for downstream
xcodebuild operations.
mikib0
added a commit
that referenced
this pull request
Jul 20, 2026
…rules The CI Checks job lints the PR merge tree (branch + development). PR #2629 added apps/swift/scripts/upload-testflight.ts to development without the allowlist entries the custom rules require, so every open PR's lint:custom fails on it (not our code): - no-owned-max-params: run(cmd, args) mirrors execFileSync(file, args) - no-raw-process-env: reads Apple creds / BUILD_NUMBER from CI env Matches the existing swift-script exclusions in both rules.
11 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Gets the native Swift iOS app archiving, signing, and uploading to TestFlight for QA — under its own bundle id, isolated from the production Expo app. Build
1784233894uploaded successfully (com.andrewbierman.packrat.swift).The app had only ever been built for the simulator / tests, so a chain of real distribution-readiness gaps had to be fixed.
Fixes
init()inPackRatApp.swift— bad merge left twoinit()bodies; iOS target failed to compile. Merged.Assets.xcassetssat under aresources:key that xcodegen silently ignores, so noAssets.car, no app icons, noCFBundleIconName(App Store errors 90713/90022/90023). Moved intosources:+ setASSETCATALOG_COMPILER_APPICON_NAME. (The macOS target has the same latentresources:bug — flagged, out of scope here.)UISupportedInterfaceOrientations(all four) — required for iPad device family1,2(error 90474).com.andrewbierman.packrat.swift(+ watch companion id) — own ASC record + isolated TestFlight tester pool, no mixing with the Expo app.DEVELOPMENT_TEAM→666HGMV2LU(Bierman Collective LLC), which owns the cert + record.upload-testflight.ts— archive + export both pass-allowProvisioningUpdates(new bundle id, no pre-existing profiles); altool uses--username/--password+--asc-provider(Apple ID belongs to multiple teams, delivery must be disambiguated).*.p12/*.cer/*.certSigningRequest),build/,build.log,upload.log.How to upload (local)
Set
APPLE_ID,APPLE_APP_PASSWORD,APPLE_TEAM_IDinapps/swift/.env.local, thenbun apps/swift/scripts/upload-testflight.ts. Requires an Apple Distribution cert installed and thecom.andrewbierman.packrat.swiftapp record registered in ASC.Follow-ups (not blocking)
resources:-dropped-asset-catalog bug.Testing
xcodebuild archive→ ARCHIVE SUCCEEDED, export → EXPORT SUCCEEDED, altool → UPLOAD SUCCEEDED with no errors. Build now processing in App Store Connect.https://claude.ai/code/session_018Aqkh7awkxfC5q4KKwjdM3
Summary by CodeRabbit